CVE-2025-59143
BaseFortify
Publication date: 2025-09-15
Last updated on: 2025-09-16
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| qix | color | 5.0.1 |
| debug | debug | 4.4.2 |
| qix | color | 5.0.2 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-506 | The product contains code that appears to be malicious in nature. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability involves the npm package 'color' version 5.0.1, which was compromised after a phishing attack on the maintainer's npm publishing account. The attacker published a malicious version containing malware that attempts to redirect cryptocurrency transactions to attacker-controlled addresses, but only when the package is used in browser environments (e.g., via direct script inclusion or bundling tools like Babel, Rollup, Vite, Next.js). Local, server, or command-line environments are not affected. The malware specifically targets cryptocurrency wallets such as MetaMask. [1]
How can this vulnerability impact me? :
If you use the compromised version 5.0.1 of the 'color' package in a browser context, your cryptocurrency transactions could be redirected to attacker-controlled addresses, potentially resulting in financial loss. This affects users who include the package directly in browser scripts or bundle it with tools like Babel, Rollup, Vite, or Next.js. Local, server, or command-line uses are not impacted. To mitigate, users should update to version 5.0.2, delete node_modules, clear package manager caches, and rebuild browser bundles. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by checking if the compromised version 5.0.1 of the 'color' npm package is present in your project, especially if used in browser contexts. You can inspect your package.json and package-lock.json or yarn.lock files for version 5.0.1 of 'color'. Additionally, scanning your browser bundles for unexpected code that attempts to redirect cryptocurrency transactions could help. Specific commands include: 1) npm list color to see installed versions; 2) grep or search your bundled JavaScript files for suspicious code related to cryptocurrency redirection; 3) checking your node_modules directory for version 5.0.1 of 'color'. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include: 1) Updating the 'color' package to version 5.0.2 or later; 2) Completely removing your node_modules directory; 3) Cleaning your package manager's global cache; 4) Rebuilding any browser bundles from scratch to ensure no malicious code remains; 5) If you operate private registries or mirrors, purge any cached copies of the compromised version 5.0.1. These steps help remove the malware payload and prevent its execution in browser environments. [1]